Web & APIs · 6 min read
HTTP Status Codes Every Developer Should Know
Every HTTP response carries a three-digit status code, and reading it is one of the fastest ways to debug a web app or API. The first digit tells you the category; the rest tells you the specifics.
This guide covers the five classes and the codes worth memorizing, including the pairs developers most often confuse.
Try it yourself with the related tool.
Browse all status codes →Advertisement
The five classes
1xx is informational, 2xx is success, 3xx is redirection, 4xx is a client error (the request was wrong), and 5xx is a server error (the request was fine but the server failed). Knowing the class alone often tells you whether the problem is on your side or the server's.
401 vs 403
These are constantly mixed up. 401 Unauthorized actually means unauthenticated — you have not proven who you are, so log in or send valid credentials. 403 Forbidden means you are authenticated but not allowed to access this resource. Fixing 401 means authenticating; fixing 403 means getting permission.
301 vs 302
301 Moved Permanently tells clients and search engines the URL has changed for good, so they update their links. 302 Found (and 307) is a temporary redirect — keep using the original URL. Using 302 where you meant 301 can stop search engines from passing ranking to the new URL.
The 5xx family
500 Internal Server Error is the generic "something broke" — check the logs, not the status. 502 Bad Gateway means a proxy got an invalid response upstream. 503 Service Unavailable usually means overload or maintenance. 504 Gateway Timeout means an upstream server did not respond in time.